AliPrice - Reflected cross-site scripting (XSS)

Summary

Name	AliPrice 1.0 - Reflected cross-site scripting (XSS)
Code name	skims-0018
Product	AliPrice
Affected versions	Version 1.0
State	Private
Release date	2025-03-14

Vulnerability

Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31297

Description

AliPrice 1.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/core/request.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in AliPrice 1.0. The following is the output of the tool:

Skims output

 364 | function aliprice_update_products( ) {
 365 |
 366 | global $wpdb;
 367 |
 368 | $from = abs( intval($_POST['position']) ) * 20 - 20;
 369 | $delete = get_site_option('aliprice-delete');
 370 | $insert = new AliExpressInsert();
 371 | $pub = new AliExpressPublish();
 372 |
 373 | $result = $insert->updateLinks( $from, 20 );
 374 |
 375 | if( !$result ) { echo 0; die(); }
 376 |
 377 | if( count($result) > 0 ) {
 378 |
 379 | print_r($result);
 380 |
 381 | foreach($result as $key => $val){
 382 | $pub->setId( $key );
 383 | $post = $pub->getDetails();
 384 |
 385 | if( !empty($post) ) {
 386 | if( $delete == 1 ) {
 387 | wp_delete_post( $post->post_id, true );
 388 | $wpdb->delete( $wpdb->prefix . ""aliprice_products"", array( 'post_id' => $post->post_id ), array( 'd' ) );
 389 | print_r( "" Delete product ID: "" . $post->post_id );
 390 | }
 391 | else{
 392 | $wpdb->update(
 393 | $wpdb->prefix . ""aliprice_products"",
 394 | array( 'availability' => 0 ),
 395 | array( 'post_id' => $post->post_id ),
 396 | array( 'd' ),
 397 | array( 'd' )
 398 | );
 399 | }
 400 | }
 401 | }
 402 | die();
 403 | }
 404 |
> 405 |   echo $_POST['position'];
  406 |
  407 |   die();
  408 |  }
      ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31297 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: AliPrice
• Version: 1.0

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline